After 6 months of development, Samba 4.23.0 has been released, continuing the Samba 4 branch with a full implementation of the domain controller and Active Directory service, compatible with Windows 2008 and capable of servicing all supported Microsoft versions of Windows clients, including Windows 11. Samba 4 is a multifunctional server product that also provides file server, print service, and identity server (winbind) implementations.
Key changes in Samba 4.23:
- Support has been added for using QUIC protocol as a transport for SMB3, which is an overlay on the UDP protocol, supporting multiplexing of multiple connections and providing encryption methods equivalent to TLS/SSL. The protocol was created in 2013 by Google as an alternative to the TCP+TLS combination for the Web, addressing issues with long connection setup times and negotiation in TCP and eliminating delays during packet loss in data transmission. Configuration parameters "client smb transports" and "server smb transport" have been added for setting up this transport, for example, to enable QUIC on server in addition to TCP in the configuration file, you can specify "server smb transports = +quic."
To use QUIC on the server side, the quic.ko kernel module needs to be loaded, which is currently provided separately but will soon be integrated into the mainline of the Linux kernel. On the client side, in the absence of the kernel module, the ngtcp2-based QUIC implementation is supported.
- Unix extensions support for SMB3 protocol is enabled by default, ensuring compatibility with clients using Linux and Unix-like OSes. Unix extensions allow for POSIX semantics on file servers and such capabilities as symbolic and hard links, locks, extended attributes, permissions, and special file types.
- The logic for updating file modification time data has been modernized to align with behavior servers based on Windows 10 and Windows Server 2016. Previously, file write timestamps were updated with a delay, but now they will reflect immediately after the write operation.
- A new utility smb_prometheus_endpoint has been added for exporting monitoring metrics in a format compatible with Prometheus.
- The command 'samba-tool domain backup' has been enhanced with the option '--no-secrets' to create backups that exclude passwords, access keys, and other secret attributes (objects msKds-ProvRootKey, msFVE-RecoveryInformation, and msTPM-InformationObject).
- In the CTDB component, responsible for managing clustered configurations, the ability to load settings from files /etc/ctdb/tunables.d/*.tunables has been implemented in addition to the configuration file /etc/ctdb/tunables.conf.
- Support for accumulating separate profiling statistics for each shared resource (share) has been added, allowing administrators to track the activity of each shared resource individually and identify bottlenecks using the smbstatus utility.
Source: opennet.ru
